a590003

g i ’s and h i ’s in one list, let us denote the generators of Z ∗ m/ 〈2〉 by {f 1 , f 2 , . . . , f n }, and let ord(f i )
be the order of f i in the quotient group at the time that it was added to the list of generators. The
the slot-index representative set is
}
T
def =
{ n
∏
i=1
f e i
i
mod m : ∀i, e i ∈ {0, 1, . . . , ord(f i ) − 1}
Clearly, we have T ⊂ Z ∗ m, and moreover T contains exactly one representative from each equivalence
class of Z ∗ m/ 〈2〉. Recall that we use these representatives in our encoding of plaintext slots, where
a polynomial a ∈ A 2 is viewed as encoding the vector of F 2 d elements ( a(ρ t ) ∈ F 2 d : t ∈ T ) , where
ρ is some fixed primitive m-th root of unity in F 2 d.
In addition to defining the sets of generators and representatives, the class PAlgebra also provides
translation methods between representations, specifically:
int ith rep(unsigned i) const;
Returns t i , i.e., the i’th representative from T .
int indexOfRep(unsigned t) const;
Returns the index i such that ith rep(i) = t.
int exponentiate(const vector& exps, bool onlySameOrd=false) const;
Takes a vector of exponents, (e 1 , . . . , e n ) and returns t = ∏ n
i=1 f e i
i
∈ T .
const int* dLog(unsigned t) const;
On input some t ∈ T , returns the discrete-logarithm of t with the f i ’s are bases. Namely, a
vector exps= (e 1 , . . . , e n ) such that exponentiate(exps)= t, and moreover 0 ≤ e i ≤ ord(f i )
for all i.
2.5 PAlgebraModTwo/PAlgebraMod2r: Plaintext Slots
These two classes implements the structure of the plaintext spaces, either A 2 = A/2A (when using
mod-2 arithmetic for the plaintext space) or A 2 r = A/2 r A (when using mod-2 r arithmetic, for
some small vale of r, e.g. mod-128 arithmetic). We typically use the mod-2 arithmetic for real
computation, but we expect to use the mod-2 r arithmetic for bootstrapping, as described in [6].
Below we cover the mod-2 case first, then extend it to mod-2 r .
For the mod-2 case, the plaintext slots are determined by the factorization of Φ m (X) modulo 2
into l degree-d polynomials. Once we have that factorization, Φ m (X) = ∏ j F j(X) (mod 2), we
choose an arbitrary factor as the “first factor”, denote it F 1 (X), and this corresponds to the first
input slot (whose representative is 1 ∈ T ). With each representative t ∈ T we then associate
the factor GCD(F 1 (X t ), Φ m (X)), with polynomial-GCD computed modulo 2. Note that fixing a
representation of the field K = Z 2 [X]/F 1 (X) ∼ = F 2 d and letting ρ be a root of F 1 in K, we get that
the factor associated with the representative t is the minimal polynomial of ρ 1/t . Yet another way
of saying the same thing, if the roots of F 1 in K are ρ, ρ 2 , ρ 4 , . . . , ρ 2d−1 then the roots of the factor
associated to t are ρ 1/t , ρ 2/t , ρ 4/t , . . . , ρ 2d−1 /t , where the arithmetic in the exponent is modulo m.
After computing the factors of Φ m (X) modulo 2 and the correspondence between these factors
and the representatives from T , the class PAlgebraModTwo provide encoding/decoding methods to
pack elements in polynomials and unpack them back. Specifically we have the following methods:
.
6
16. Design and Implementation of a Homomorphic-Encryption Library